KALLISTI BLOCKCHAIN FORENSICS
TRC-20 (USDT primary asset) + native TRX
---
Target Wallet Address
THDW2bQZicUiuJxkWHhtmva9b37JFWnMf4
Report Date: 2026-06-01 · Prepared by Kallisti Blockchain Forensics
Wallet Identity · Financial Overview · Holdings · Activity Patterns · Account Structure
| Entity | THDW2bQZicUiuJxkWHhtmva9b37JFWnMf4 |
| Blockchain | TRON mainnet · TRC-20 USDT wallet |
| Account Age | 785 days (2.15 years) ‖ Active: 2024-03-28 12:12:15 UTC → 2026-05-23 09:31:27 UTC |
| TRX Balance | 15496.3217 TRX |
| Transactions | 362 total · 258 USDT transfers (132 in · 126 out) · 127 counterparties |
| Total USDT In | $511.74M |
| Total USDT Out | $509.69M |
| Net Balance | $2.05M |
Total USDT throughput reached $511.74M inbound across 132 events and $509.69M outbound across 126 events over 785 days, yielding a 99.6% pass-through ratio and a $2.05M residual balance. The net-zero drift pattern is characteristic of relay or exchange clearing infrastructure rather than an accumulation wallet.
A single unattributed address (TYtRsvRY...) provides 77.1% of inflows ($394.4M) while simultaneously receiving 7.5% of outflows ($38.0M), creating a circular relay topology. WhiteBIT (TWBPGLwQ...) accounts for 18.4% of inflows ($94.2M) as the sole confirmed regulated exchange. All five top outflow destinations are unattributed, with the largest (TWzkgw7c...) acting as a same-day forwarding relay.
Inbound transfers cluster in the $5M–$185M range with 19 transactions exceeding $5M; outbound transactions show aggressive round-lot batching with 36+ exact $5,000,000 disbursements in Feb 2026. This denomination uniformity and batch scheduling are consistent with automated treasury management or exchange settlement, not retail activity.
The wallet holds 15,496 TRX ($5.4K)—sufficient for energy delegation without depleting operating capital. Arkham identifies THDW2b as Tron Energy Delegate for HitBTC deposit wallet TLUd7, indicating operator-level exchange infrastructure. TRX float is maintained but not staked; bandwidth (600/600) remains available, consistent with delegated energy supply from a parent account.
Activity peaks UTC 08–16 (77.5% of all transfers), with Thursday at 33.7% of total volume and Sunday at only 0.8%. This business-hours pattern maps to UTC+2 to UTC+4 timezones, consistent with HitBTC's operational profile. Three-phase lifecycle: $94M accumulation (2024-Q2), nine-month dormancy, $417M active operations (2025), then $421M drawdown batch (Jan–Feb 2026).
| S1 | Tronscan — On-chain dataset · tronscan.org/#/address/THDW2bQZicUiuJxkWHhtmva9b37JFWnMf4 |
| S2 | OKLink — TRON Address Detail · www.oklink.com/tron/address/THDW2bQZicUiuJxkWHhtmva9b37JFWnM… |
Counterparty Map · Inflow Architecture · Outflow Architecture
Upstream · Top 5 Funders
| ID | Address | Volume in | Attribution | Risk |
|---|---|---|---|---|
| A1 | TYtRsvRY5a23BHnm6pa3oCfPxoTeHtz12P | $394.41M | Unattributed | MEDIUM |
| A2 | TWBPGLwQw2EbqYLLw1DJnTDt2ZQ9yJW1JJ | $94.22M | WhiteBIT. DepositAndWithdrawAndGasfee_2 | LOW |
| A3 | TGsvpota8aPKbKqhGp7NXkiib8hEYz8iAt | $22.80M | Unattributed | MEDIUM |
| A4 | TTFMJFbLzExLzL3FMLjVc8c8kDvA3bfbHz | $298,500.07 | Unattributed | MEDIUM |
| A5 | TSk3vJk7b7xmr2M63L9MzSsaPbpai3xXPQ | $2,450.00 | Money Laundering | MEDIUM |
Downstream · Top 5 Destinations
| ID | Address | Volume out | Attribution | Risk |
|---|---|---|---|---|
| B1 | TWzkgw7cRB7HxZG7cBCRU92XSH2QJjCGAo | $150.00M | Unattributed | MEDIUM |
| B2 | TRegQY5unrnxMMPVW3362cmWsYLSmc6fbx | $48.00M | Unattributed | MEDIUM |
| B3 | TYtRsvRY5a23BHnm6pa3oCfPxoTeHtz12P | $38.00M | Unattributed | MEDIUM |
| B4 | TSJSRRGRppXUTQrXXfPq7dNnQRdm4sGrf4 | $7.00M | Unattributed | LOW |
| B5 | TA1tiMQQnKh7i9KzxgP5bQYAjTxqZ6A97U | $5.00M | Unattributed | LOW |
The top inflow source (TYtRsvRY..., 77.1% / $394.4M) also appears as the third-largest outflow destination (7.5% / $38.0M), creating a circular relay topology. The top outflow destination (TWzkgw7c..., 29.4% / $150.0M) is a single-purpose relay with only 6 total transactions: it received $150.0M primarily from the subject wallet and forwarded 99.9% onward to TVcRXiS... within hours. This double-hop structure — subject receives from relay, disbursement relay forwards onward — is consistent with exchange clearing operations and does not indicate adversarial layering.
Account Structure · Protocol Interactions · Threat Exposure
| Address Type | TRON EOA — externally owned account (non-contract) |
| Script Encoding | TRC-20 / TRX native (TRON mainnet) |
| Clustering | Arkham: Tron Energy Delegate for HitBTC Deposit (TLUd7) — operator-level entity cluster |
| Service Label | HitBTC (Arkham attribution) · WhiteBIT counterparty confirmed |
| VASP Exposure | WhiteBIT confirmed (18.4% of inflows); HitBTC probable (energy delegate infrastructure) |
| TRX Float | 15,496.3217 TRX ($5.4K) — maintained for energy/bandwidth delegation |
| Wallet Software | Unknown — likely exchange-operated; no retail wallet signature detected |
| Category | Status |
|---|---|
| Exchange Deposits / Withdrawals | REVIEW WhiteBIT confirmed (18.4% of inflows, $94.22M); HitBTC probable (energy delegate attribution) |
| DeFi / Smart Contract Interaction | NONE None detected — all transactions are direct TRC-20 USDT transfers |
| Lightning Network Channels | N/A N/A — TRON blockchain |
| Ordinals / Inscriptions | N/A N/A — TRON blockchain |
| Mixing / CoinJoin Services | NONE None — TRON energy delegation confirmed as operational mechanism, not obfuscation |
| Cross-Chain Bridges | NONE None detected |
| Sanctions-Listed Address Contact | NONE None — no OFAC/EU/UN-listed counterparty confirmed |
This wallet operates as high-volume pass-through relay infrastructure attributed to HitBTC by Arkham Intelligence. The 99.6% throughput ratio, circular relay topology, and automated $5M batch disbursements are operationally consistent with an exchange clearing or settlement account. The sole confirmed adverse signal is a structuring-pattern indicator from the Feb 2026 batch drawdown; no sanctions, fraud, or darknet exposure was identified.
| CRITERION | FINDING | ASSESSMENT | |
| 1. Sanctions (OFAC/EU/UN) | CLEAR | ||
| 2. Fraud/Scam Exposure | CLEAR | ||
| 3. Ransomware/Darknet | CLEAR | ||
| 4. Mixer/CoinJoin | CLEAR | ||
| 5. Exchange Source Verif. | LOW | ||
| 6. Structuring/Layering | MEDIUM | ||
| 7. Third-Party Risk | CLEAR | ||
| 8. Address Poisoning | CLEAR |
Overall AML risk is LOW (score 18/100). Seven of eight screening criteria return CLEAR. The MEDIUM flag on Structuring/Layering reflects the automated $5M batch disbursement pattern observed in Feb 2026 — a structural indicator that warrants monitoring but does not constitute a confirmed violation. Exchange Source Verif. scores LOW due to the 81.6% unattributed inflow chain from a single relay address; resolution requires further on-chain tracing or voluntary disclosure from HitBTC.
The AML risk is LOW and dominated by exchange infrastructure patterns. Clients or counterparties transacting with this address face LOW regulatory exposure, assuming HitBTC attribution is confirmed. The single elevated flag — MEDIUM on Structuring/Layering — reflects an automated batch pattern that could trigger SAR obligations in some jurisdictions if the 72-hour $5M disbursement cadence is confirmed as intentional denomination fragmentation. Recommend obtaining a voluntary declaration from HitBTC before clearing this address for unrestricted use.
Flagged Patterns & Significant Observations
| ID | Date | Event | Severity | Significance |
| A-01 | 2025-01-13 | Single-Event $184.7M Mega-Inflow. Largest single transfer in the wallet's lifetime, received in one transaction representing 36.1% of total lifetime inflow. | NOTABLE | Indicative of institutional settlement or exchange reserve transfer. No adverse counterparty confirmed. |
| A-02 | 2026-02-04 | Automated $5M Batch Drawdown. 36+ exact $5,000,000 disbursements executed over 72 hours (2026-02-04/05/06), totaling approximately $180M with denomination uniformity indicating scripted execution. | HIGH | Structuring-pattern indicator. Consistent with automated treasury operation but warrants SAR consideration if confirmed as intentional denomination fragmentation. |
| A-03 | LIFETIME | Bidirectional Relay with Primary Funder. Address TYtRsvRY... functions as both the 77.1% inflow source and a 7.5% outflow destination, creating a circular relay topology across the wallet's full operating history. | NOTABLE | Typical of exchange clearing network architecture; not inherently adverse but complicates provenance tracing. |
| A-04 | 2024-04-08 | High-Velocity Onboarding Burst. 20 transactions depositing $89.7M executed over a two-day window (2024-04-08/09) during wallet activation, with individual transfers ranging from $2.4M to $7.6M. | NOTABLE | Consistent with exchange wallet provisioning or initial capital deployment. No adverse association. |
| A-05 | 2025-12-08 | Probe-and-Drain Pattern Initiation. Series of $1–$100 probe transactions received in late 2025, coinciding with the start of the first material outflow phase. Small probes appear to test address liveness ahead of large disbursements. | NOTABLE | Consistent with automated operational testing of exchange relay infrastructure. No poisoning success observed. |
Five notable events define this wallet's lifecycle: a high-velocity onboarding burst in April 2024 ($89.7M across 20 transactions), a $184.7M single-event mega-inflow in January 2025, a period of routine $5–38M institutional transfers through 2025, an automated batch drawdown of ~$421M in February 2026 using exact $5M lots, and subsequent low-activity monitoring through May 2026. The Feb 2026 drawdown is the most operationally significant event and warrants further investigation as a structuring-pattern indicator.
Hypothesis Assessment
Arkham labels address as Tron Energy Delegate for HitBTC Deposit (TLUd7). Institutional-scale batch operations, business-hours UTC+3 concentration, and $511M relay throughput are consistent with exchange clearing infrastructure. WhiteBIT co-involvement suggests multi-CEX operational role.
81.6% inflow from a single unattributed relay suggests possible peer-to-peer or OTC settlement arrangement. Round-lot $5M disbursement batches and near-zero final balance are consistent with OTC treasury management operating alongside known CEX partners.
Cannot rule out a second exchange using the same TRON energy delegation pattern. Arkham's HitBTC label may be proximate rather than exact. Operator identity requires on-chain confirmation via KYC or regulatory disclosure.
Probabilities sum to 100%. Attribution confidence: MED-HIGH.
With 60% probability, this address is HitBTC exchange operational infrastructure — specifically a TRON energy delegation account that routes USDT between exchange deposit wallets. The 30% OTC/liquidity-provider hypothesis cannot be discounted given the high proportion of unattributed relay-to-relay flows. Attribution confidence is MED-HIGH based on Arkham label alone; confirmation would require corroboration from OKLink entity data or direct exchange disclosure.
Government Records · Press Coverage · Research & Analytics · Blockchain Intelligence
The digital footprint for this address is limited to three sources: Arkham (entity label confirmed), OKLink (balance/transaction count confirmed), and Tronscan (full on-chain history). No adverse coverage was found in press databases, government records, or fraud reporting platforms. The Arkham HitBTC energy-delegate label is the primary intelligence finding and is consistent with the observed on-chain behavior.
Priority Actions & Engagement Opportunities
| P1 | HitBTC Compliance Information Request — Submit formal request to HitBTC compliance team to confirm address ownership, account type, and transaction authorization for THDW2bQZicUiuJxkWHhtmva9b37JFWnMf4. Reference Arkham energy-delegate label as attribution basis. · Legal |
| P2 | Upstream Relay Tracing — TYtRsvRY... — Expand on-chain investigation of primary inflow address TYtRsvRY5a23BHnm6pa3oCfPxoTeHtz12P (77.1% of inflows, $394.4M). Identify entity labels, trace to originating exchanges or OTC desks. · On-chain |
| P3 | SAR Consideration — Feb 2026 Batch Drawdown — Evaluate 2026-02-04/05/06 batch disbursement pattern (36+ exact $5M lots) for SAR filing under structuring/layering criteria. Document denomination uniformity and scheduling as supporting evidence. · SAR |
| P4 | Monitor Top 5 Outflow Destinations — Set on-chain monitoring alerts for TWzkgw7c... ($150M), TRegQY5u... ($48M), TYtRsvRY... ($38M), TSJSRRGRp... ($7M), and TA1tiMQQn... ($5M) for further disbursement or attribution activity. · On-chain |
Priority actions are: (1) submit information request to HitBTC via legal or compliance channel to confirm account ownership and transaction authorization; (2) expand on-chain tracing of the primary relay wallet TYtRsvRY... to establish ultimate source of the 81.6% unattributed inflows; (3) file SAR if the Feb 2026 batch drawdown is confirmed as structuring. Monitor all five top outflow destinations for further disbursement activity.
| REF | SOURCE |
|---|---|
| S1 | On-chain dataset -- TRC-20 Transfers https://tronscan.org/#/address/THDW2bQZicUiuJxkWHhtmva9b37JF… Full TRC-20 transfer history via Tronscan API. Retrieved 2026-06-01. |
| S2 | On-chain dataset -- Raw Transactions https://tronscan.org/#/address/THDW2bQZicUiuJxkWHhtmva9b37JF… Full transaction log via Tronscan API. Retrieved 2026-06-01. |
| S3 | Arkham -- Address Profile https://intel.arkm.com/explorer/address/THDW2bQZicUiuJxkWHht… Screenshot captured 2026-06-01. File: screenshot_arkham.png |
| S4 | Tronscan -- Address Profile https://tronscan.org/#/address/THDW2bQZicUiuJxkWHhtmva9b37JF… Screenshot captured 2026-06-01. File: screenshot_tronscan.png |
| S5 | Oklink -- Address Profile https://www.oklink.com/tron/address/THDW2bQZicUiuJxkWHhtmva9… Screenshot captured 2026-06-01. File: screenshot_oklink.png |
| TERM | DEFINITION |
|---|---|
| Energy Delegation (TRON) | A mechanism where one TRON address stakes TRX to grant another address transaction energy/bandwidth, enabling fee-free USDT transfers — commonly used by exchanges for deposit wallets. |
| Pass-Through Wallet | A wallet that receives and rapidly redistributes funds with minimal retention, resulting in a near-zero net balance relative to total throughput; typical of exchange relay or clearing infrastructure. |
| Structuring | The practice of breaking large transactions into smaller amounts to avoid reporting thresholds; a financial crime indicator when denomination patterns are uniform and scheduling is automated. |
| Energy Delegate | On TRON, an address specifically designated to receive staked energy from a parent account; Arkham uses this label to identify operational infrastructure of exchanges. |
| TRC-20 | The TRON blockchain token standard used for USDT on TRON; analogous to ERC-20 on Ethereum. Transfers require energy or bandwidth, supplied via delegation. |
| Circular Relay | A fund flow pattern where the same address appears as both a source and destination for a given wallet, indicating a clearing or settlement loop rather than linear value movement. |
| Batch Disbursement | The automated release of multiple equal-sized transfers in rapid succession; when lots are exact round numbers, it signals programmatic execution rather than manual operation. |
| AML Score | A 0.0–1.0 measure of confirmed contamination on a specific risk criterion; 0.08 is the floor/CLEAR value and 1.0 represents confirmed, verified exposure. |
| Provenance Chain | The traceable sequence of prior wallets and entities from which funds originated; incomplete chains (high unattributed %) reduce confidence in AML clearance. |